I would like a bucket policy that allows access to all objects in the bucket, and to do operations on the bucket itself like listing objects. (Action is s3:*.)
I was able to solve this by using two distinct resource names: one for arn:aws:s3:::examplebucket/* and one for arn:aws:s3:::examplebucket.
Is there a better way to do this - is there a way to specify a resource identifier that refers to the bucket itself and all its contained objects, in one shot?